Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY

First Issued: Wed Jun 3 12:58:42 CDT 2015
|Updated: Wed Jun 3 16:10:11 CDT 2015
|Update: Corrected affected fileset levels

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/java_april2015_advisory.asc
https://aix.software.ibm.com/aix/efixes/security/java_april2015_advisory.asc
ftp://aix.software.ibm.com/aix/efixes/security/java_april2015_advisory.asc

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX
CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480
CVE-2015-0486 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-2808
CVE-2015-1916 CVE-2015-1914 CVE-2015-0192 CVE-2015-0204

===============================================================================

SUMMARY:

There are multiple vulnerabilities in IBM SDK Java Technology Edition,
Versions 5, 6, 7, 7.1 that are used by AIX. These issues were disclosed as
part of the IBM Java SDK updates in April 2015.

This bulletin also addresses FREAK: Factoring Attack on RSA-EXPORT keys'
SSL/TLS vulnerability and RC4 Bar Mitzvah Attack for SSL/TLS vulnerability.

===============================================================================

VULNERABILITY DETAILS:

CVE-2015-0204 was fixed in IBM SDK, Java Technology Edition under
CVE-2015-0138. Both CVEs are included in this advisory for completeness. 

CVEID: CVE-2015-0491
DESCRIPTION: An unspecified vulnerability related to the 2D component has
    complete confidentiality impact, complete integrity impact, and
    complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102329 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) 

CVEID: CVE-2015-0459
DESCRIPTION: An unspecified vulnerability related to the 2D component has
    complete confidentiality impact, complete integrity impact, and
    complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102328 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) 

CVEID: CVE-2015-0469
DESCRIPTION: An unspecified vulnerability related to the 2D component has
    complete confidentiality impact, complete integrity impact, and
    complete availability impact.
CVSS Base Score: 10
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102327 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) 

CVEID: CVE-2015-0458
DESCRIPTION: An unspecified vulnerability related to the Deployment
    component has complete confidentiality impact, complete integrity
    impact, and complete availability impact.
CVSS Base Score: 7.6
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102332 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:H/Au:N/C:C/I:C/A:C) 

CVEID: CVE-2015-0480
DESCRIPTION: A directory traversal vulnerability related to the Tools
    component and the extraction of JAR archive files could allow remote
    attacker to overwrite files on the system with privileges of another
    user.
CVSS Base Score: 5.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102334 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:P) 

CVEID: CVE-2015-0488
DESCRIPTION: An unspecified vulnerability related to the JSSE component
    could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102336 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) 

CVEID: CVE-2015-0478
DESCRIPTION: An unspecified vulnerability related to the JCE component
    could allow a remote attacker to obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102339 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N) 

CVEID: CVE-2015-0477
DESCRIPTION: An unspecified vulnerability related to the Beans component
    has no confidentiality impact, partial integrity impact, and no
    availability impact.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102337 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N) 

CVEID: CVE-2015-0204
DESCRIPTION: A vulnerability in the OpenSSL ssl3_get_key_exchange
    function could allow a remote attacker to downgrade the security of
    certain TLS connections. An OpenSSL client accepts the use of an RSA
    temporary key in a non-export RSA key exchange ciphersuite. This
    could allow a remote attacker using man-in-the-middle techniques to
    facilitate brute-force decryption of TLS/SSL traffic between
    vulnerable clients and servers. This vulnerability is also known as
    the FREAK attack.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/99707 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-0192
DESCRIPTION: A vulnerability in the IBM implementation of the Java
    Virtual Machine may, under limited circumstances, allow untrusted
    code running under a security manager to elevate its privileges.
CVSS Base Score: 6.8
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101008 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P) 

CVEID: CVE-2015-0486
DESCRIPTION: An unspecified vulnerability related to the Deployment
    component could allow a remote attacker to obtain sensitive
    information.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/102335 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVEID: CVE-2015-2808
DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL
    protocol, could allow a remote attacker to obtain sensitive
    information. An attacker could exploit this vulnerability to remotely
    expose account credentials without requiring an active
    man-in-the-middle session. Successful exploitation could allow an
    attacker to retrieve credit card data or other sensitive information.
    This vulnerability is commonly referred to as "Bar Mitzvah Attack".
CVSS Base Score: 5
CVSS Temporal Score: See
    https://exchange.xforce.ibmcloud.com/vulnerabilities/101851
    for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) 

CVEID: CVE-2015-1916
DESCRIPTION: Server applications which use the IBM Java Secure Socket
    Extension provider to accept SSL/TLS connections are vulnerable to a
    denial of service attack due to an unspecified vulnerability.
CVSS Base Score: 5
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101995 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P) 

CVEID: CVE-2015-1914
DESCRIPTION: A vulnerability in the IBM implementation of the Java Virtual
    Machine may allow untrusted code running under a security manager to
    bypass permission checks and view sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/101908 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N) 

CVEID: CVE-2015-0138
DESCRIPTION: A vulnerability in various IBM SSL/TLS implementations could
    allow a remote attacker to downgrade the security of certain SSL/TLS
    connections. An IBM SSL/TLS client implementation could accept the use
    of an RSA temporary key in a non-export RSA key exchange ciphersuite.
    This could allow a remote attacker using man-in-the-middle techniques
    to facilitate brute-force decryption of TLS/SSL traffic between
    vulnerable clients and servers. This vulnerability is also known as the
    FREAK attack.
CVSS Base Score: 4.3
CVSS Temporal Score: See http://xforce.iss.net/xforce/xfdb/100691 for the
    current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

AFFECTED PRODUCTS AND VERSIONS:

    AIX 5.3, 6.1, 7.1
    VIOS 2.2.x

    The following fileset levels (VRMF) are vulnerable, if the 
    respective Java version is installed:
    For Java5:  Less than 5.0.0.600
    For Java6:  Less than 6.0.0.480
    For Java7:  Less than 7.0.0.205
    For Java7.1:  Less than 7.1.0.85

    Note:  to find out whether the affected Java filesets are installed 
    on your systems, refer to the lslpp command found in AIX user's guide.

    Example:  lslpp -L | grep -i java


REMEDIATION:

    IBM SDK, Java Technology Edition, Version 5.0 Service Refresh 16 
    Fix Pack 10 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=5.0.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=5.0.0.0&platform=AIX+64-bit,+pSeries&function=all

    IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix 
    Pack 4 and subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=6.0.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=6.0.0.0&platform=AIX+64-bit,+pSeries&function=all

    IBM SDK, Java Technology Edition, Version 7 Service Refresh 9 and
    subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+32-bit,+pSeries&function=all 
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+64-bit,+pSeries&function=all

    IBM SDK, Java Technology Edition, Version 7.1 Service Refresh 3 and
    subsequent releases:
32-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+32-bit,+pSeries&function=all
64-bit: https://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+64-bit,+pSeries&function=all 

WORKAROUNDS AND MITIGATIONS:

    None.

===============================================================================

CONTACT US:

If you would like to receive AIX Security Advisories via email,
please visit "My Notifications":

    http://www.ibm.com/support/mynotifications

To view previously issued advisories, please visit:

    http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq

Comments regarding the content of this announcement can be
directed to:

    [email protected]

To obtain the OpenSSL public key that can be used to verify the
signed advisories and ifixes:

    Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt

To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team via [email protected] you
can either:

    A. Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgppubkey.txt

    B. Download the key from a PGP Public Key Server. The key ID is:

        0x28BFAA12

Please contact your local IBM AIX support center for any
assistance.

REFERENCES:

Complete CVSS Guide:  http://www.first.org/cvss/cvss-guide.html
On-line Calculator V2:
    http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
IBM Java SDK Security Bulletin: 
    http://www-01.ibm.com/support/docview.wss?uid=swg21883640 

ACKNOWLEDGEMENTS:

CVE-2015-1916 and CVE-2015-0138 were reported to IBM by Karthikeyan
Bhargavan of the PROSECCO team at INRIA 

CHANGE HISTORY:

First Issued: Wed Jun  3 12:58:42 CDT 2015 

| Updated: Wed Jun 3 16:10:11 CDT 2015
| Update: Corrected affected fileset levels

===============================================================================

*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.

Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an “industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.